mokhtar f168247b33 cut: build the release with the official zig tarball, skip hidden bundle files; re-pin 0.0.17 ...

The first 0.0.17 cut (run 687) failed verify-pins in CI for two reasons. The asset generator embedded admin/dist/.src-hash, a freshness stamp that CI's artifact copy does not carry; it now skips dotfiles. And the Arch zig package emits different code than the ziglang.org tarball that CI installs, so the cut downloads the pinned tarball (ZIG_TARBALL_SHA256 in gates.yml, the full digest keys the cache) and builds the release with it. flake.nix is re-pinned to the bytes both now produce.

The saturated-primary pool test gates its holders on a semaphore instead of sleeps and releases every spawned holder on the way out, so a loaded runner cannot flake it. The package job uploads the payload before the pin check and runs the check when the version or flake.nix changed against the parent. The verify-a-release recipe clones the tag first and builds with the official zig.

2026-09-08 23:57:07 +02:00

..

ci.yml

ci: allow dispatching the gate set, a replaced runner pod kills the job it holds

2026-08-14 02:34:06 +02:00

gates.yml

cut: build the release with the official zig tarball, skip hidden bundle files; re-pin 0.0.17

2026-09-08 23:57:07 +02:00

live-tls.yml

milestone 14: build, package, sign and publish releases

2026-08-08 12:38:29 +02:00

release.yml

cut: build the release with the official zig tarball, skip hidden bundle files; re-pin 0.0.17

2026-09-08 23:57:07 +02:00